taskqueue_start_threads() swallows lwkt_create failures and always returns 0 (mirror of DF-2850 in subr_taskqueue.c)
| Field | Value |
|---|---|
| ID | DF-2871 |
| Status | new |
| Severity | Low |
| CVSS 3.1 | CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H |
| CWE | CWE-754 Improper Check for Exceptional Conditions |
| File | sys/kern/subr_taskqueue.c |
| Lines | 594-606 |
| Area | kern |
| Confidence | certain |
| Discovered | 2026-09-02 |
| Pass | 2 (GLM 5.3 second pass) |
| Bucket | base:kern |
| Reported | pending |
| Known CVE | none |
| CVE match | novel |
Summary
On lwkt_create error the loop kprintf's, NULLs the slot and continues,
then unconditionally return 0. Total failure yields an unrunnable
queue whose enqueues still succeed — every future taskqueue_drain on it
sleeps forever (ta_pending never clears, no waker); partial failure
silently degrades. Same defect class as DF-2850 (gtaskqueue) — this is
the subr_taskqueue.c sibling. Fix: track the error, and on
tq_tcount==0 free tq_threads and return it so callers abort.
Timeline
- 2026-09-02 Discovered during pass-2 audit of subr_taskqueue.c (GLM 5.3).
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-2871 · 1 files| File | Type | Description | Size | |
|---|---|---|---|---|
| fix.diff | — | 1004 B | view raw |
Fix verification
not_testableError propagation fix (mirror of DF-2850) compile-validated; failure not injectable.
compile-validated in the fix-all kernel build (make nativekernel, 0 errors)
Confirmed kernel references
Detail
Evidence (decisive lines)
subr_taskqueue.c:594-597 swallow; :606 return 0
PoC changes
n/a
Verified recommended fix
--- sys/kern/subr_taskqueue.c 2026-06-29 12:51:19.000000000 +0000
Verdict
Code-verified mirror of DF-2850 in subr_taskqueue.c; failure not injectable on a live guest. taskqueue_start_threads (sys/kern/subr_taskqueue.c:583-606) kprintfs, NULLs the slot and continues on lwkt_create error (:594-597), then unconditionally returns 0 (:606): total thread-creation failure yields an unrunnable queue whose enqueues still succeed and whose drains sleep forever with no error. Same injection problem as DF-2850 (lwkt_create cannot be made to fail deterministically at queue start). The error-propagation fix (first-error tracking, partial teardown, return error) is compile-validated.
No comments yet.